Organisations that do not have a clear longer-term security roadmap in place are putting themselves at risk of being compromised. It is the companies that are already investing in tomorrow’s tools to solve today’s problems that will survive the ongoing onslaught to circumvent security solutions. This is the view of Jon Tullett, research manager – IT Services for Sub-Saharan Africa at International Data Corporation (IDC).

“The first step in creating this roadmap is to start getting their security under control,” he says. “This includes using analytics for behaviour anomaly detection at both a network and user level, gathering the data to do baseline profiling. While that is the type of thing we are already doing today, many organisations are still not doing it with a long-term view in mind.”

To get their security under control, organisations must consider technologies that play to the cloud and be prepared to evolve with the technology. User awareness and training also remain key fundamentals that are receiving enough attention. “At the moment, training budgets are horrifically small and that must be addressed. Start by spending the money, but more importantly, evolve that training over time. Today, the breach is a credential theft or phishing attack. Companies that tackle that, and really invest in training, see tremendous reductions. A good example of this is Google, which combined good training with two-factor authentication for all their internal services and, since they’ve done that they’ve had zero phishing cases, but now they’ve moved on,” says Tullett.

He says once organisations have this under control and have done the risk assessments required, they must start devolving those rights. “Break it up and create far more granular access controls. Create accounts which can only do very specific tasks, so that if they are compromised, the damage the hacker can do is limited. That also means that you’ve got to start evolving the technologies that you’re using to ones that support this. While it can be a pain to do it on some platforms, it is usually baked into modern cloud platforms. The key here is to ensure that should you need to revoke access on mass, you can do it.”

Tullett says the next step is to roll out two-factor authentication much more aggressively. “For users that may mean a token, mobile authentication or something similar and for system accounts it will probably mean digital certificates. Whatever it may be, start to improve your authentication. Once you have that in place, you really want to be on top of activity management. So, looking at what are accounts are doing what. You can’t really do this until you have your accounts consolidated and organised, but you want to know everything that an account does in a very standard format. That allows you to feed the information into an engine and get an activity report back when something goes wrong, so that you can identify any anomalies and address them quickly.”

He believes that within the next 2 years, most of this type of anomaly detection will be happening largely out of the cloud. “This is going to happen alongside your evolution to cloud. The AI platforms in the cloud are maturing very fast, so within the next couple of years we’re expecting to see an awful lot of cloud services just plugging AI in because they can. So, there will be a lot of machine learning happening and, further down the line, we will see people looking how they can use that to optimise and automate,” says Tullett. “In the longer-term, organisations will also start looking at automation, where an anomaly will be detected, and automatically invested and remediated. While it will take a couple of years for to this to happen, organisations must include this in their security roadmaps. Today’s problems are that you need to start getting your identities under control and doing better analytics, but tomorrow that same platform is going to be your machine learning platform and is going to be a complex, better managed identity platform that will do a lot more things.”

Tullett points out that the criminals also have a roadmap and it is often more advanced than those of organisations. “They know what technologies are coming, they are getting the required skills in place and are already looking at how to use the technology for various purposes. They are following a roadmap and if you are not doing the same, they are leaving you behind. You must remember that these are career criminals, this is what they do for a living, so, if you make it impossible for them to phish, they are going to find something else to compromise. What they are doing will evolve in response to you. If we can eradicate phishing, that’s great, but that threat is going to move to something else and you must be willing to keep following that path.”

About IDC

International Data Corporation (IDC) is the premier global provider of market intelligence, advisory services, and events for the information technology, telecommunications, and consumer technology markets. With more than 1,100 analysts worldwide, IDC offers global, regional, and local expertise on technology and industry opportunities and trends in over 110 countries. IDC's analysis and insight helps IT professionals, business executives, and the investment community to make fact-based technology decisions and to achieve their key business objectives. Founded in 1964, IDC is a subsidiary of IDG, the world's leading technology media, research, and events company. To learn more about IDC, please visit www.idc.com. Follow IDC on Twitter at @IDC. 

IDC in the Middle East, Africa, and Turkey

For the Middle East, Africa, and Turkey region, IDC retains a coordinated network of offices in Riyadh, Nairobi, Lagos, Johannesburg, Cairo, and Istanbul, with a regional center in Dubai. Our coverage couples local insight with an international perspective to provide a comprehensive understanding of markets in these dynamic regions. Our market intelligence services are unparalleled in depth, consistency, scope, and accuracy. IDC Middle East, Africa, and Turkey currently fields over 130 analysts, consultants, and conference associates across the region. To learn more about IDC MEA, please visit www.idc-cema.com. You can follow IDC MEA on Twitter at @IDCMEA and IDC SSA at @IDC_SSA